This line is in iptables

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT

Do I need something more than port 53 ? it replies using telnet, but nslookup gives a timeout.

  • If you're planning on running a name server and don't know which ports and which protocols it uses you are heading for an epic fail – goo Jul 14 '11 at 21:54

As mentioned, see http://tools.ietf.org/html/rfc5966. To properly support DNS, you need to allow port 53 for both TCP and UDP. Failure to do so will result in much higher packet fragmentation, particularly with the introduction of IPv6 and DNSSEC (note that all version of BIND since 9.2 will indicate it supports DNSSEC even if you haven't configured DNSSEC (unless you compile it out)). This particularly sucks when people filter out fragments.

| improve this answer | |
  • officially, RFC 5966 only applies to implementors of DNS components, and not to operators, although it does include the caveat that not allowing TCP might cause various breakage. – Alnitak Jul 14 '11 at 10:04

DNS runs on UDP 53 not tcp 53 change your iptables rule to:

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
| improve this answer | |
  • 3
    Actually, you need both TCP and UDP. UDP for most queries and TCP for any larger amount of data such as a zone transfer. – dmourati Jul 13 '11 at 23:34
  • 1
    @dmourati, you only need TCP if you are doing a zone transfers or you have a ridiculously large DNS RR or a GIANT TXT record and a large one at that. for 90% of the use cases all you need is udp 53 and opening ports you don't need is not a great idea. – Zypher Jul 13 '11 at 23:45
  • I agree which was why I referred to the zone transfer example. See RFC 5966: tools.ietf.org/html/rfc5966 You should go one step further and configure BIND allow-transfer options. – dmourati Jul 13 '11 at 23:49
  • 2
    It's not easy to predict when you'll need to do DNS over TCP, and there are a lot more instances where it's becoming required (stuffing DNSSEC into a UDP packet can get exciting). Advising people who don't know what they're doing to restrict tcp/53 is a recipe for incredibly difficult-to-diagnose DNS resolution problems. – womble Jul 13 '11 at 23:52
  • 1
    @Zypher Both UDP and TCP are needed - dmourati is right. ObDisclaimer - I wrote that RFC. – Alnitak Jul 14 '11 at 10:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.